GDPR
Privacy policy
Data controller
The controller of personal data collected on thegranges.fr is:
- Company
- Société d'Exploitation des Granges de Béthencourt (SAS)
- SIREN
- 995 320 330
- Address
- 22 rue Jean Jaurès, 59540 Béthencourt, France
- Representative
- Guillaume Aubry, President
- GDPR contact
- contact@thegranges.fr
- DPO
- None appointed (the company does not meet the mandatory designation criteria of Article 37 GDPR).
Data we collect
We collect only the data strictly necessary for the purposes described below. You are never required to give us personal information to browse the site.
| Source | Data collected | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| « Discuter » conversation agent | Messages exchanged, and contact details if you provide them (name, e-mail, optional phone) | Answer your questions and prepare your request | Consent (you start the conversation) | 3 years from last contact |
| Request forms | Contact: first and last name, e-mail, phone (optional), subject, occasion, group size, target date (optional), budget (optional), message content, language, UTM source/medium/campaign if present. Date request: chosen date, one or two nights, second evening dinner. Gift voucher order: what is offered, value, recipient's first name, "from", message, recipient's e-mail if sent directly to them, preferred send date. Corporate quote request: company, package, period. Backstage request: date, number of people, age attestation. | Reply, prepare the quote or voucher, organise your visit | Pre-contractual measures (art. 6.1.b) and consent for optional fields | 3 years after last contact; for an order or booking, the statutory accounting records retention period (10 years) |
| Information window (homepage) | E-mail and expressed choice. Sent via Hestia's mail server (hosted by OVH, France). | Inform you of opening and dates | Consent | Until you unsubscribe, 3 years at most without interaction |
| « Suggest to my group » tool, invitation, kitty | No personal data is collected by the site. The shared link contains only group size and dates. The message is sent via the application you choose (WhatsApp, SMS, e-mail), under its own policy. | Share an invitation with your group | No processing by the site | Not applicable |
| Embedded YouTube video | No data is transmitted until you start playback (youtube-nocookie mode; on the homepage, the video loads only on click) | Video playback | Consent to playback | Handled by YouTube |
| Google Analytics 4 | With cookies (if you accept): anonymised identifier, pages viewed, visit duration, device type, country. Without cookies (default, or if you decline): anonymous aggregated ping, no identifier. | Measure site audience and improve content | Consent (GDPR art. 6.1.a) — denied by default | 13 months (cookies) · 0 (cookieless ping) |
| Server logs (Vercel) | IP address, user-agent, page accessed, timestamp | Security, anonymised audience statistics, abuse prevention | Legitimate interest (GDPR art. 6.1.f) | 30 days |
Recipients of your data
Your data is never sold, rented or exchanged. It is accessible only to authorised personnel within the company and to the following technical processors:
- Vercel Inc. (site hosting), United States. Transfer governed by EU Standard Contractual Clauses and the Data Privacy Framework.
- Hestia Projekt (mail server for e-mails related to your requests and the homepage information form, hosted in France by OVH), France.
- Hestia Projekt (server for the « Discuter » conversation agent, hosted in France by OVH), France.
- xAI (Grok model, processing of conversation agent messages), United States. Transfer outside the European Union governed by the European Commission's Standard Contractual Clauses.
- Google Ireland Ltd. (Google Fonts, Google Analytics 4 — only if you consent or in cookieless mode, YouTube playback if triggered), Ireland. Transfers to the United States are covered by the DPF.
Cookies and audience measurement
The site uses Google Analytics 4 to measure its audience anonymously and improve content. No advertising cookies and no cross-site tracking are used.
Default mode — Google Consent Mode v2
Until you have made a choice, or if you have declined, Google Analytics runs in "cookieless ping" mode: no cookie is set on your browser, and the data sent is aggregated and anonymised — no user identifier, IP anonymised, no cross-referencing with other Google data.
If you accept cookies
If you click Accept, the following cookies are set:
| Name | Duration | Purpose |
|---|---|---|
_ga | 13 months | Identifies a unique visitor for Google Analytics |
_ga_5YX0NM7JRP | 13 months | Maintains session state for the GA4 property |
Other functional cookies
- YouTube cookies: set only if you start playback of the embedded video (privacy-enhanced mode).
Manage your choice
Your choice is stored for 13 months (maximum duration recommended by the CNIL). You can change it or withdraw your consent at any time:
Your rights
Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights regarding your personal data:
- Access: obtain a copy of the data concerning you;
- Rectification: correct inaccurate or incomplete data;
- Erasure: request the deletion of your data;
- Object: object to the processing of your data;
- Restriction: restrict the use of your data;
- Portability: receive your data in a structured format;
- Withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before that withdrawal.
To exercise these rights, contact us at contact@thegranges.fr. You will receive a reply within one month.
Complaint
If you believe your data is not being processed in accordance with the regulations, you have the right to lodge a complaint with the French data-protection authority CNIL: cnil.fr/en/plaintes.
Changes
This policy may be updated at any time, in particular to reflect technical or regulatory changes or new site features. The date of the last update is shown below.
Last updated: 3 October 2026